Tag: damages

SaaS Agreements – Terms and Conditions – Data Processing Agreement

UK SaaS suppliers currently have limited obligations to SaaS customers when processing personal data as part of their SaaS services. Under the General Data Protection Regulation (GDPR) many new data processing obligations are imposed on SaaS suppliers. In particular, the obligation for SaaS suppliers to enter into a written data processing agreement with SaaS customers and subcontractors.

GDPR applies to UK SaaS Suppliers despite Brexit

Regardless of when and how Brexit takes place, the GDPR will apply to SaaS suppliers located within the UK if:

  • They offer goods or services to SaaS customers located within the EU (i.e. in any of the remaining 27 EU Member States); or
  • They monitor the behaviour of EU data subjects;

Even though UK SaaS suppliers will no longer be located within the EU themselves after a Brexit.

GDPR applies to non-EU SaaS Suppliers

The GDPR automatically applies to all SaaS suppliers located outside of the EU i.e. in the USA, if:

  • They offer goods or services to SaaS customers located within the EU; or
  • They monitor the behaviour of EU data subjects;

Even though the SaaS supplier is not located within the EU.

Written Data Processing Agreement

Under the GDPR SaaS suppliers and SaaS customers must include detailed data processing obligations in a written data processing agreement. This can form part of the SaaS Agreement or be a separate schedule or agreement.

SaaS Suppliers should be aware that they need to enter into written data processing agreements not just with all SaaS customers, but also with all entities or persons who process personal data on their behalf, such as:

  • All subcontractors i.e. data centres, penetration testing providers;
  • All subsidiaries i.e. providing customer support, software maintenance and support.

Fines for Breach

Data subjects can claim damages directly from SaaS suppliers who breach:

  • Any obligations under the GDPR; or
  • Any lawful instructions of a SaaS customer.

In addition data protection authorities can fine SaaS suppliers or SaaS customers up to 4% of annual global turnover or 20m Euros (whichever is higher) for breaches of the GDPR.

Preparing for Change

To ensure compliance with the new obligations placed on SaaS suppliers (data processors) under the GDPR, SaaS suppliers should taking the following steps:

  • Review existing data protection policies and procedures for compliance with the GDPR;
  • Adapt existing privacy, security and data breach policies to comply with the new rules before the 25th of May 2018;
  • Create a written data processing agreement which reflects the above polices and which is compliant with the GDPR;
  • Review existing SaaS agreements to check limitations on liabilities and indemnities for data protection breaches;
  • Identify any subcontractors and subsidiaries who process personal data;
  • Audit compliance of subcontractors and subsidiaries with new policies and procedures; and
  • Add written data processing agreements to all existing agreements with SaaS customers, subcontractors and subsidiaries.

Help

Irene Bodle is an IT lawyer specialising in SaaS, with over 15 years experience in dealing with SaaS, cloud computing and IT law issues. If you require assistance with any SaaS agreements, cloud computing concerns or any other IT legal issues please contact me at:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

Website Legal Requirements – Tweeting – 5 Legal Offences to Avoid

There have recently been a number of high profile cases on liability for the sending of inappropriate tweets in the UK and the USA.

As tweeting becomes more and more the norm for many businesses it is important to consider the legal consequences of staff sending inappropriate tweets. Before allowing, permitting or encouraging staff to start tweeting on your behalf or with your brand you should consider creating a tweeting policy. This should set out guidelines on what is, and what is not permitted. It should also state whether any approval needs to be obtained before tweets are sent. Staff should be made aware of this policy and agree to comply with it.

Below is a brief summary of 5 possible offences that you should specifically cover in your tweeting policy.

Misrepresentation

Tweets containing false information that might induce another person to act on it.

Harassment

Tweeting words that cause ‘alarm’ or ‘distress’.

Malicious Tweets

Being “reckless” with the truth or sending false information in tweets for the purpose of damaging another’s commercial interests.

Defamatory Comments

Tweeting information that damages a person’s reputation unless you can prove that the information is a truthful, honest opinion.

Menacing Tweets

Tweeting content that is grossly offensive, indecent, obscene or menacing.

Penalties for Tweeting Offences

If a court in the UK finds you liable for any of the above offences you could be:

  • fined;
  • imprisoned for up to 2 years;
  • liable to pay damages for losses suffered;
  • liable to pay compensation for causing distress;
  • sued for libel and face an order for damages and costs.

It is therefore important that you consider whether there is a business need to protect yourself and your business from such potential “tweeting” claims.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles:

SaaS Agreements – The Advantages of using English Law

If you are a SaaS supplier who often deals with customers located outside of the UK, you will have experienced customers insisting on their local law applying to your SaaS agreement. Many SaaS suppliers agree to this by simply removing “English law” from the SaaS agreement and replacing it with, for example, “German law” unaware of the consequences this will have upon their SaaS terms and conditions.

Law and Jurisdiction

There is an important difference between applicable law and applicable jurisdiction. Applicable law specifies the country’s laws that will apply to your SaaS agreement, if there is a dispute. Jurisdiction specifies which courts will have authority to deal with a dispute. Usually your SaaS agreement will specify England and Wales as the applicable law and the courts of England as the jurisdiction.

Therefore, if you change the applicable law in your SaaS agreement you may also want to consider changing the country in which the courts are located that will deal with any disputes.

Language

Do not forget to specify in the SaaS agreement in which language disputes should be dealt with. If you do not speak or understand the local language of your customer, you should state that all disputes must be dealt with in English, particularly if you have agreed to your SaaS agreement being translated into your customer’s local language. You should also state that the English version of the SaaS agreement will prevail if there is a discrepancy between the two versions.

Limitation of Liability

By agreeing to a change of the law applicable to your SaaS agreement you could automatically be invalidating many of the limitations on liability contained in your SaaS agreement. For example, in France and Germany you cannot limit your liability for gross negligence, wilful misconduct, breach of material obligations or some types of force majeure.

Damages Available

By agreeing to a change of the law applicable to your SaaS agreement you may also become liable for types of damages that you claim to exclude in your SaaS agreement, i.e. direct damages, indirect damages, typically foreseeable damages, punitive damages, as in some countries liability cannot be limited for these types of damages or the local understanding of what types of losses fall within these areas may differ from English law.

Consumer or Business

By agreeing to a change of the law applicable to your SaaS agreement you could become liable to local laws that apply to consumer contracts, even though you are contracting with a business. For example, in France if you enter into a SaaS agreement with a business which does not operate in your business sector – the customer will be considered to be a consumer and will be protected by local consumer protection laws.

Extra Rights

By agreeing to a change of the law applicable to your SaaS agreement you may grant customers new rights that do not exist under English law. For example, in Germany under mandatory German law a customer can lower the price it pays for the SaaS services if the service is defective.

General

For the above reasons English law is often the law of choice used in international SaaS agreements. Suppliers can more easily avoid “hidden” mandatory laws which can invalidate your carefully drafted supplier terms and conditions and English law allows you more freedom to draft terms free from mandatory legal restrictions.

Help

Irene Bodle is an IT lawyer specialising in SaaS agreements with over 10 years experience in the IT sector. If you require assistance with any SaaS, ASP, software on demand contracts or any other IT legal issues contact me:

irene.bodle@bodlelaw.com
www.bodlelaw.com

To register for my newsletter click here

______________________________________________________

Other related articles: